Account
Sign in to post pet updates and save your product list.
This account system is a demo — not a real one.
· Passwords are neither verified nor stored — the format is checked, then discarded
· Your account exists only in this browser on this computer — switch devices and it is gone
· There is no server, and nothing is uploaded
· Production needs a server, password hashing, rate limiting and session management. See About Us ›
· Passwords are neither verified nor stored — the format is checked, then discarded
· Your account exists only in this browser on this computer — switch devices and it is gone
· There is no server, and nothing is uploaded
· Production needs a server, password hashing, rate limiting and session management. See About Us ›
Before launch, all of this must be replaced with the real thing.
-
Password storage
Hash on the server with bcrypt, scrypt or Argon2id, salted. Never plaintext, never MD5 or SHA1. Hashing in the browser provides no security — do not invent your own scheme.
-
Session management
Use httpOnly, Secure, SameSite cookies, or short-lived tokens with refresh. Never keep long-lived credentials in localStorage.
-
Credential-stuffing defence
Rate-limit the sign-in and sign-up endpoints, and lock the account or add a CAPTCHA after repeated failures.
-
Recovery and verification
Email and phone verification, plus password reset. Without them, a forgotten password means a permanently lost account.